CVE-2026-40320: 
Python vulnerability analysis and mitigation

CVE-2026-40320 is an unsandboxed Jinja2 template rendering vulnerability in the giskard-checks Python library, specifically within the ConformityCheck class. The rule parameter is silently passed through Jinja2's default Template() constructor, meaning any template expressions embedded in rule definitions are evaluated at runtime without sandboxing. This affects giskard-checks versions <= 1.0.1b1; the issue was fixed in version 1.0.2b1. Disclosed on April 13–14, 2026 via GitHub Security Advisory GHSA-7xjm-g8f4-rp26, it carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). In conformity.py (line 59), the affected code constructs a Jinja2 template directly from the user-supplied rule string: formatted_rule = Template(self.rule).render(trace=trace). Because Jinja2's default Template() constructor provides no sandboxing, any Jinja2 expression — including those that invoke Python builtins or OS-level commands — is evaluated at runtime. Exploitation requires an attacker to have write access to a check definition file (e.g., a shared project configuration or externally contributed file) and for a developer to subsequently execute the test suite, triggering template evaluation (GitHub Advisory).

Successful exploitation allows arbitrary code execution in the context of the developer running the test suite, with high impact to confidentiality, integrity, and availability of the local system. An attacker who can inject a malicious Jinja2 expression into a rule parameter — for example via a shared project file or contributed configuration — can read sensitive files, modify data, or execute arbitrary OS commands on the developer's machine. Because giskard-checks is a local developer library with no network-facing service, the blast radius is limited to the developer's workstation and any secrets or credentials accessible from it (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for write access to a check definition and developer-initiated test execution, making opportunistic or remote exploitation unlikely (GitHub Advisory).

1. Identify a target: Locate a project that uses giskard-checks <= 1.0.1b1 and loads check definitions from a shared or externally contributed source (e.g., a shared repository, project config file, or CI pipeline configuration).
2. Gain write access: Obtain write access to a check definition file — for example, by contributing to an open-source project, submitting a pull request, or compromising a shared configuration repository.
3. Inject a malicious Jinja2 payload: Modify the rule parameter of a ConformityCheck definition to include a Jinja2 expression that executes arbitrary code, such as:

   rule: "{{ ''.__class__.__mro__[1].__subclasses__()[<index>](['id'], capture_output=True).stdout }}"

   or a reverse shell payload using Python's subprocess or os modules.
4. Trigger execution: Wait for or social-engineer a developer to run the test suite (e.g., pytest or equivalent), which causes ConformityCheck to render the rule string through Jinja2's Template(), evaluating the injected expression.
5. Achieve code execution: The injected payload executes in the context of the developer's local environment, potentially exfiltrating credentials, secrets, or establishing persistence (GitHub Advisory).

• File System: Unexpected modifications to check definition files (e.g., conformity.py or project YAML/JSON config files) containing Jinja2 expressions such as {{, }}, __class__, __subclasses__, subprocess, or os.system.
• Process: Unusual child processes spawned by the Python test runner (e.g., bash, sh, curl, wget, python) during test suite execution.
• Logs: Test runner output containing unexpected command output, error tracebacks referencing Jinja2 Template() rendering, or anomalous data in test results.
• Network: Unexpected outbound network connections from the developer workstation initiated during test suite execution (e.g., reverse shell callbacks or data exfiltration attempts).

Upgrade giskard-checks to version >= 1.0.2b1, in which Jinja2 template rendering has been removed entirely from the rule parameter evaluation in ConformityCheck. No configuration-based workaround is available for unpatched versions. As an interim measure, developers should avoid loading check definitions from untrusted or externally contributed sources until the upgrade is applied, and should audit existing check definition files for unexpected Jinja2 template expressions (GitHub Advisory).

The vulnerability was credited to researcher @dhabaleshwar for identifying the unsandboxed template usage and was published by mattbit on behalf of Giskard-AI. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (GitHub Advisory).